An APT verification bypass can let an attacker replace a package and run code as root. Learn how to patch CI/CD runners and container images, and use Harden-Runner to find HTTP package downloads and ...
On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.
Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the ...
Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...
litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and the official Docker images. The attacker hijacked BerriAI's release workflow with a GitHub ...
An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an ...
GhostAction returns: compromised maintainers push a fake security-audit.yml workflow that steals CI/CD secrets and cloud credentials from GitHub repos.
npm compromised package and cooldown checks Two StepSecurity GitHub Checks stop this kind of attack at the pull request, before anything is installed. The Package Compromised Updates check fails a PR ...
For MemoryOS 2.0.34, include hosts where a normal import could reach logging initialization. Remove or quarantine the affected release and use an independently vetted replacement; this inspection did ...
56 supply chain attacks in 12 months, each with a StepSecurity Threat Center alert. The data, the worms, the Team PCP numbers, and how to defend.
A compromised maintainer account and a same-day impersonator of one of Rust's best-known authors turned a routine cargo update into silent remote code execution. Three crates from the same owner were ...
CloudSEK has published the victim list from Team PCP's supply chain campaign: 78,330 secrets exfiltrated from the CI/CD pipelines of 2,186 organizations over five days in March 2026. StepSecurity's ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results